Packages / Debian 12 (Bookworm) / libs / libexpat1

Package: libexpat1 (2.5.0-1+deb12u3)

Libreria C per il parsing XML - libreria runtime

Other Packages Related to libexpat1:

dep: [libc6] (>= 2.36)
GNU C Library: Shared libraries

Download libexpat1

Architecture	Package size	Installed size	Files	Package
amd64	101 KiB	396 KiB	list of files	Download
arm64	86 KiB	436 KiB	list of files	Download

Percorsi file del pacchetto (12)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

/lib/aarch64-linux-gnu/libexpat.so.1
/lib/aarch64-linux-gnu/libexpat.so.1.8.10
/lib/x86_64-linux-gnu/libexpat.so.1
/lib/x86_64-linux-gnu/libexpat.so.1.8.10
/usr/lib/aarch64-linux-gnu/libexpatw.so.1
/usr/lib/aarch64-linux-gnu/libexpatw.so.1.8.10
/usr/lib/x86_64-linux-gnu/libexpatw.so.1
/usr/lib/x86_64-linux-gnu/libexpatw.so.1.8.10
/usr/share/doc/libexpat1/AUTHORS
/usr/share/doc/libexpat1/changelog.Debian.gz
/usr/share/doc/libexpat1/changelog.gz
/usr/share/doc/libexpat1/copyright

Field source: Debian 12 (Bookworm) security main amd64

Usa questo pacchetto

OpenFactory può avviare questo sistema operativo in una macchina virtuale del browser, o iniziare una costruzione che include il nome nativo del pacchetto di questo record.

Prova Debian 12 (Bookworm) nel browser Crea un'immagine che include libexpat1

Versioni, suite e repository

Ogni riga è metadato dell'indice pacchetti per una versione, architettura, suite e repository. Nomi, URL e dimensioni arrivano dalla fonte; un link è un punto di recupero mutabile, non una redistribuzione OpenFactory.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
2.5.0-1+deb12u3	bookworm-security / main	amd64	Debian 12 security · main · amd64	101 KiB	396 KiB	pool/updates/main/e/expat/libexpat1_2.5.0-1+deb12u3_amd64.deb
2.5.0-1+deb12u3	bookworm-security / main	arm64	Debian 12 security · main · arm64	86 KiB	436 KiB	pool/updates/main/e/expat/libexpat1_2.5.0-1+deb12u3_arm64.deb

Field source: Debian 12 (Bookworm) security main amd64

Vulnerabilità note

L’associazione dei pacchetti è in corso.

CVE	Gravità	Impatto per versione
[CVE-2026-115506] expat: CVE-2026-115506	High(8.7)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata dsa · expat · debian · bookworm; dsa · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata dsa · expat · debian · bookworm; dsa · expat · debian · 12
[CVE-2026-77214] expat: CVE-2026-77214	High(8.3)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u5` dsa · expat · debian · bookworm; dsa · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u5` dsa · expat · debian · bookworm; dsa · expat · debian · 12
[CVE-2026-102633] libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to ap	High(8.2)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u5` nvd · expat · debian · bookworm; nvd · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u5` nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-93990] Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML c	High(8.7)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` nvd · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` nvd · expat · debian · bookworm
[CVE-2026-66046] Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-no	High(8.7)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` nvd · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` nvd · expat · debian · bookworm
[CVE-2026-56132] In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.	High(8.7)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u5` nvd · expat · debian · bookworm; nvd · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u5` nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-45186] In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.	High(7.5)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` nvd · expat · debian · bookworm; nvd · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-41080] libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.	Medium(6.9)	Interessata Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata nvd · expat · debian · bookworm; nvd · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata nvd · expat · debian · bookworm; nvd · expat · debian · 12
[CVE-2026-32776] Expat vulnerabilities	High(7.5)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 24, 2026, 12:37:08 AM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12
[CVE-2026-32777] Expat vulnerabilities	High(7.5)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 24, 2026, 12:37:08 AM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12
[CVE-2026-32778] Expat vulnerabilities	Medium(6.9)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 24, 2026, 12:37:08 AM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12
[CVE-2026-25210] Expat vulnerabilities	High(7.8)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 24, 2026, 1:10:56 AM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12
[CVE-2026-24515] Expat vulnerabilities	Medium(5.5)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 24, 2026, 2:00:25 AM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12 `2.5.0-1+deb12u3` · arm64 · bookworm-security Interessata · Corretta: `2.5.0-1+deb12u4` usn · expat · debian · bookworm; usn · expat · debian · 12
[CVE-2022-43680] libxmltok: CVE-2022-43680	High(8.1)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 6:30:19 PM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Corretta · Corretta: `2.5.0-1` dsa · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Corretta · Corretta: `2.5.0-1` dsa · expat · debian · bookworm
[CVE-2022-40674] libxmltok: CVE-2022-40674	Critical(9.8)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 6:29:43 PM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Corretta · Corretta: `2.4.8-2` dsa · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Corretta · Corretta: `2.4.8-2` dsa · expat · debian · bookworm
[CVE-2022-25313] libxmltok: CVE-2022-25313	Medium(6.5)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 6:24:56 PM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Corretta · Corretta: `2.4.5-1` dsa · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Corretta · Corretta: `2.4.5-1` dsa · expat · debian · bookworm
[CVE-2022-25314] libxmltok: CVE-2022-25314	High(8.8)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 6:24:57 PM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Corretta · Corretta: `2.4.5-1` dsa · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Corretta · Corretta: `2.4.5-1` dsa · expat · debian · bookworm
[CVE-2022-25315] libxmltok: CVE-2022-25315	Critical(9.8)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 6:24:57 PM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Corretta · Corretta: `2.4.5-1` dsa · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Corretta · Corretta: `2.4.5-1` dsa · expat · debian · bookworm
[CVE-2022-25235] XML-RPC for C and C++ vulnerabilities	Critical(9.8)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 6:24:54 PM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Corretta · Corretta: `2.4.5-1` usn · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Corretta · Corretta: `2.4.5-1` usn · expat · debian · bookworm
[CVE-2022-25236] XML-RPC for C and C++ vulnerabilities	Critical(9.8)	Sconosciuto L’associazione dei pacchetti è in corso. Osservato: Oct 23, 2026, 6:24:54 PM UTC Dettagli (2) `2.5.0-1+deb12u3` · amd64 · bookworm-security Corretta · Corretta: `2.4.5-1` usn · expat · debian · bookworm `2.5.0-1+deb12u3` · arm64 · bookworm-security Corretta · Corretta: `2.4.5-1` usn · expat · debian · bookworm

[Altri risultati]

Ultima sincronizzazione: Oct 24, 2026, 6:20:57 AM UTC

[Catalogo CVE]

Checksum

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

2.5.0-1+deb12u3 / amd64Osservato Sep 1, 2026sha256 04405c19b977…8920ca75Impronta della fonte

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Impronta della fonte (sha256): 04405c19b977d19c5e0fd7210e452b8044a065cb45a82012d45046738920ca75

Verifica download

printf '%s  %s\n' '04405c19b977d19c5e0fd7210e452b8044a065cb45a82012d45046738920ca75' 'libexpat1_2.5.0-1+deb12u3_amd64.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) security main amd64

2.5.0-1+deb12u3 / arm64Osservato Sep 1, 2026sha256 3caad0fb4382…49a233bcImpronta della fonte

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Impronta della fonte (sha256): 3caad0fb4382e206b005737de35b3193450589a10053f8415ded216649a233bc

Verifica download

printf '%s  %s\n' '3caad0fb4382e206b005737de35b3193450589a10053f8415ded216649a233bc' 'libexpat1_2.5.0-1+deb12u3_arm64.deb' | sha256sum --check --strict -

Field source: Debian 12 (Bookworm) security main arm64

Fonti

Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Observed SHA-256
9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Result
match verified
Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/bookworm/InRelease
Signed-object SHA-256
77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Observed SHA-256
2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Result
match verified
Debian 12 (Bookworm) security main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-security-main-amd64:f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/bookworm-security/InRelease
Signed-object SHA-256
6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
Signer fingerprint
ED541312A33F1128F10B1C6C54404762BBB6E853
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Observed SHA-256
f6c2fe702b8cabb044e7bb46c5eaf3962abb6cfed5fcac896ffeb271b9d15104
Result
match verified
Debian 12 (Bookworm) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Prova della firma
bookworm-security-main-arm64:f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/bookworm-security/InRelease
Signed-object SHA-256
6d12b591dde8841119e7e66de94b2af438681faebffabe08ea364290f7aaee1c
Signer fingerprint
ED541312A33F1128F10B1C6C54404762BBB6E853
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Observed SHA-256
f9b8756324afddf50b1c19d6d46164158c0361909fddc40b48777ad665dfdb14
Result
match verified